CISA adds bugs exploited by commercial surveillance spyware to Known Exploited Vulnerabilities catalog

Internet Explorer is affected by a memory corruption vulnerability (mapped by CISA to CWE-94) that can be triggered when the browser processes specially crafted web content, allowing remote attackers to execute code or cause a denial of service. An attacker typically triggers the flaw by luring a user to visit an attacker-crafted or compromised website that corrupts browser memory during processing. Successful exploitation can give the attacker code execution in the context of the current user, with a browser or system crash as an alternative outcome. Those affected are users of legacy, end-of-life Microsoft Internet Explorer on Windows, which CISA's required action explicitly flags as an EOL product that should be disconnected if still in use. Exploitation is confirmed: CISA added CVE-2013-3163 to the Known Exploited Vulnerabilities catalog on 2023-03-30 (in the KEV update tied to bugs used by commercial surveillance spyware), EPSS assigns a 70.7% probability of exploitation within 30 days (99th percentile), ransomware use is unknown, and no public proof-of-concept is known.

Do: Because the impacted product is end-of-life, follow CISA's required action: inventory and retire or disconnect Internet Explorer wherever it is still in use, migrating users to Microsoft Edge (using Edge IE mode where legacy apps require it). If a still-supported legacy OS must keep standalone IE, confirm the June 2013 cumulative Internet Explorer update (MS13-047) or later patches are applied and restrict IE to trusted sites. Given confirmed in-the-wild exploitation and EPSS of ~71%, prioritize remediation of any remaining EOL IE deployments and hunt for anomalous browser crash or child-process activity.

CVE-2017-7494, widely known as "SambaCry," is a remote code execution vulnerability (CWE-94, code injection) in Samba versions since 3.5.0, fixed in 4.6.4, 4.5.10, and 4.4.14. A malicious client with write access to a share uploads a shared library to a writable share and then causes the Samba server to load and execute it, giving the attacker code execution on the host with the privileges of the Samba service. Because Samba is bundled with most Linux distributions and with NAS and other embedded devices, both enterprise Linux servers and consumer/small-business NAS appliances are affected; Debian also ships affected Samba packages. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2023-03-30) with known ransomware use, and public reporting ties it to the SambaCry, CowerSnail, ETERNALSILENCE, and SHELLBIND malware campaigns. EPSS assigns a 99.4% probability of exploitation within 30 days (100th percentile).

Do: Upgrade Samba to 4.6.4 or later (4.6.x), 4.5.10 or later (4.5.x), or 4.4.14 or later (4.4.x/earlier), or install updated samba packages from your distribution (e.g., Debian) per vendor instructions, as required by the CISA KEV catalog. Until patched, remove or restrict write access on shares reachable by untrusted clients, and audit writable shares for unexpected shared-library (.so) files that may have been planted by attackers. Prioritize internet-facing Samba servers and NAS devices, given confirmed ransomware and IoT/NAS malware exploitation of this flaw.

CVE-2021-30900 is an out-of-bounds write (CWE-787) in the kernel of Apple iOS, iPadOS, and macOS, addressed by Apple with improved bounds checking. It is triggered locally when a user runs a malicious application crafted to exploit the flaw (CVSS local vector with user interaction required). Successful exploitation allows the attacker to execute arbitrary code with kernel privileges, effectively yielding full control of the device. Anyone running an affected build is exposed: iOS/iPadOS versions prior to 14.8.1 and 15.1, plus macOS builds listed in Apple's advisory. The bug has been exploited in the wild in commercial spyware campaigns observed by Google TAG in Italy, Malaysia, Kazakhstan, and the UAE, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-03-30 (EPSS 5.2%, 92nd percentile; ransomware use unknown).

Do: Update devices to iOS/iPadOS 14.8.1 or 15.1 (or later) and apply the corresponding macOS security update per Apple's instructions, consistent with CISA's KEV required action. Inventory mobile fleets via MDM for devices still on older builds and prioritize remediation where spyware campaigns in Italy, Malaysia, Kazakhstan, or the UAE are relevant, checking device logs for signs of compromise since these exploit chains often bundle additional flaws.

CVE-2022-22706 is a memory-safety flaw (CWE-119) in the Arm Mali GPU kernel driver that lets a local, non-privileged user gain write access to memory pages that should be read-only, potentially enabling privilege escalation or tampering with protected memory (CVSS 3.1: 7.8, local attack vector). It is triggered by a low-privileged local user interacting with the GPU driver on devices running affected Midgard (r26p0-r31p0), Bifrost (r0p0-r35p0), or Valhall (r19p0-r35p0) driver releases, which are widely shipped in Android SoCs such as those from MediaTek and HiSilicon. A successful attacker gains high confidentiality, integrity, and availability impact on the local device. CISA added the bug to the Known Exploited Vulnerabilities catalog on 2023-03-30, and security reporting ties Mali GPU driver zero-day exploitation to commercial spyware campaigns targeting Android and iOS users in Italy, Malaysia, Kazakhstan, and the UAE. The fix reached end users through vendor firmware, including the June 2023 Android security update.

Do: Apply updated Arm Mali GPU kernel drivers via your device/SoC vendor's firmware, ensuring Android endpoints are on security patch levels that include the fix (the June 2023 Android Security Bulletin shipped the Mali driver fix). Enterprises should inventory Android devices using Mali-based SoCs (e.g., MediaTek, HiSilicon) and prioritize patching devices exposed to spyware-targeted users; no workarounds are documented, and the CISA KEV required action is to apply updates per vendor instructions.

Google Chromium's Network Service contains a use-after-free vulnerability (CWE-416) that a remote attacker can trigger via a crafted HTML page, potentially causing heap corruption in the browser process. An attacker who successfully exploits the flaw could achieve memory corruption that may lead to browser crashes or arbitrary code execution when a user visits attacker-controlled web content. Any application built on Chromium is potentially affected, including but not limited to Google Chrome, Microsoft Edge, and Opera, meaning the impact spans a very large share of the world's browser users. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on 2023-03-30, indicating confirmed exploitation in the wild, though ransomware association is unknown and no public proof-of-concept is cataloged. No CVSS score is available yet, but EPSS assigns a 24.7% probability of exploitation within 30 days (98th percentile), underscoring elevated exploitation risk.

Do: Apply browser updates per vendor instructions immediately — update Google Chrome, Microsoft Edge, Opera, and any other Chromium-based browsers deployed in your environment to the latest vendor-supplied patched releases (exact fixed version numbers were not provided in this data; check each vendor's security advisory). Because the flaw is confirmed exploited in the wild and listed in CISA KEV, prioritize patching internet-facing browsing endpoints and users who routinely visit untrusted web content; there are no reliable workarounds beyond patching, though limiting browsing to trusted sites reduces exposure.

CVE-2022-38181 is a use-after-free (CWE-416) in the Arm Mali GPU kernel driver in which GPU memory operations are mishandled, allowing unprivileged users to access freed memory. A low-privileged attacker can trigger the flaw and gain confidentiality, integrity, and availability impact (CVSS 3.1: 8.8 High), typically leveraged within exploit chains to escalate privileges in the kernel. The bug affects the Bifrost, Valhall, and Midgard Mali driver families across the version ranges listed below, meaning virtually any device running an affected Mali GPU driver is exposed, including Android smartphones such as Google Pixel devices. The vulnerability is being actively exploited: it was used in commercial spyware campaigns on Android and iOS devices reported in Italy, Malaysia, Kazakhstan, and the UAE, documented by Google TAG and GitHub Security Lab, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-03-30.

Do: Apply updates per vendor instructions as required by CISA KEV: device makers and SoC integrators should upgrade the Mali GPU kernel driver to releases newer than the affected ranges (beyond r39p0 for Bifrost/Valhall and beyond r32p0 for Midgard). End users and administrators should promptly install the latest Android/security firmware updates from their device vendor and inventory devices running affected Mali drivers for prioritized patching.

Fortra Cobalt Strike's Teamserver fails to properly validate the username field in a Beacon's configuration (CWE-20), producing a cross-site scripting flaw (CWE-79). An attacker who has already compromised a machine running a Cobalt Strike beacon can set a malformed username in the beacon configuration, and the injected content executes when it is rendered in the Teamserver, which the vendor notes can be escalated to executing code remotely on the Teamserver. Code execution on the Teamserver hands the attacker control of the C2 infrastructure itself, including beacon configurations, operator sessions, and the credentials and tooling managed there. Any organization running Fortra Cobalt Strike is affected, with risk highest where an operator is actively interacting with a Teamserver that has beacons from potentially compromised hosts. The flaw is already listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-03-30), carries a high EPSS score of about 46%, and no public proof-of-concept is recorded in the source data.

Do: Apply Fortra's updated Cobalt Strike release as soon as possible, per the CISA KEV required action to apply updates per vendor instructions. Because triggering the flaw presupposes an existing beacon foothold, hunt for and evict active beacons in the environment and be cautious rendering content from untrusted beacons in the Teamserver UI. Confirm the team server is running the patched build before treating the finding as remediated.

Fortra (formerly HelpSystems) Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are rendered in the Swing components of its user interface, an improper-escaping flaw (CWE-116). An attacker who can cause crafted HTML — for example, content delivered through beacon or team-server data and displayed in the console — to appear in the UI can trigger remote code execution in the Cobalt Strike client, consistent with the CVSS 3.1 score of 9.8 (network vector, low complexity, no privileges or user interaction required). Successful exploitation yields code execution on the machine running the Cobalt Strike UI, typically the operator's workstation, potentially exposing the attacker's or red teamer's tooling, active C2 sessions, and any environments they are connected to. Anyone running the affected release is exposed, including users of unlicensed/copied installations, which are widespread in both legitimate and criminal use of this tool. The bug is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-03-30, with press reports linking its exploitation to commercial surveillance spyware), carries an EPSS of about 2.7%, and no public PoC is known; one related headline notes the vendor's patch initially fell short, so defenders should verify they are running a fully fixed build.

Do: Apply updates per Fortra/HelpSystems instructions (the CISA KEV required action) and confirm the running Cobalt Strike client and team server are on a build with the complete HTML-escaping fix, since the vendor's first patch reportedly fell short. Until patched, treat UI-rendered beacon and event content as untrusted input and limit team-server exposure to untrusted networks.

CVE-2023-0266 is a use-after-free (CWE-416) in the ALSA PCM subsystem of the Linux kernel: the SNDRV_CTL_IOCTL_ELEM_READ32 and SNDRV_CTL_IOCTL_ELEM_WRITE32 compat ioctl handlers are missing locking, so a local user can trigger access to a control element that has already been freed. An attacker with low-privilege local user access on a system with the ALSA subsystem can exploit this race to escalate privileges and gain ring0 (kernel-level) access. The flaw affects Linux kernel builds fixed by commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e, including kernels shipped in distributions such as Debian. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-03-30, and reporting around commercial surveillance spyware campaigns (per Google TAG) indicates it was used as a zero-day in spyware exploit chains. EPSS assigns a 3.7% probability of exploitation in the next 30 days (89th percentile), and no public proof-of-concept is known.

Do: Upgrade affected systems to a Linux kernel that includes fix commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e, and apply vendor updates per instructions — for Debian systems, install the updated kernel packages from Debian security updates and reboot to load the patched kernel. Prioritize multi-user servers and workstations where untrusted or low-privilege local users can execute code, as this is a local privilege escalation vector with in-the-wild spyware exploitation. As interim mitigation, restrict which local users can access ALS device nodes (e.g., /dev/snd/*) or limit local account access on exposed systems.